fix(bundler): enforce version pin on bundled preset/extension installs

[jawwad-ali]

Description

Bundle manifests pin component versions for reproducibility, enforced by _assert_pinned_version. But the bundled install branch of _PresetKindManager/_ExtensionKindManager returns before that check:

bundled = _locate_bundled_preset(component.id)
if bundled is not None:
    self._manager.install_from_directory(bundled, speckit_version, priority)
    return   # <-- _assert_pinned_version (below) never runs for bundled assets

So a bundle pinning e.g. 2.0.0 silently installs whatever version the bundled asset ships (1.0.0) — the pin is only enforced on the catalog path. Reproduced on main @ 92b7cf7: a ComponentRef(version="2.0.0") against a bundled extension.yml of 1.0.0 installs with no error. (_WorkflowKindManager already enforces the pin unconditionally, so this is an internal inconsistency.)

Fix

Read the bundled asset's own declared version from its manifest (best-effort — None on unreadable/invalid, which _assert_pinned_version treats as "cannot enforce", matching the catalog "advertises no version" escape hatch) and call _assert_pinned_version before install_from_directory in both bundled branches.

Testing

New tests (mirror the existing _assert_pinned_version / bundled-workflow test style):

• bundled extension & preset with a 2.0.0 pin vs 1.0.0 manifest → BundlerError "pinned to version 2.0.0", and install_from_directory is not called;
• matching pin and unpinned (version=None) → install proceeds.

Mismatch tests fail-before ("DID NOT RAISE", verified by source-stash); full test_bundler_primitives.py: 15 passed. uvx ruff check clean.

AI Disclosure

• I did use AI assistance (describe below)

Found and fixed with Claude Code (Claude Fable 5) under my direction. AI spotted the early-return bypassing the pin in the bundled branch vs the workflow manager's unconditional enforcement; I reproduced the silent pin violation, verified fail-before/pass-after, and reviewed the diff.